SQL exploit makes the rounds on the internet

A large number of IIS-hosted websites are potentially vulnerable to a newly discovered SQL injection attack, report Hackademix and the Internet Storm Center. Thousands of sites have been compromised since January, mostly where web developers have failed to sanitize their user inputs properly.

Hackers attempt to exploit the presence of a special system table in Microsoft SQL Server, which contains information about the structure of the database. The basic code, needed for the exploit, has been found packaged into an executable application, which automatically searches Google for files with the .asp extension and then attempts to pollute the database via an SQL injection. If successful, the application will insert malicious JavaScript into the attacked page. The potential danger of this particular exploit comes from the fact that is works with generic code, and does not need to be tailored specifically to every web page.

From the user side, the NoScript extension will render dangerous pages harmless. Webmasters with affected sites will need to restore from their database backups and implement basic measures against SQL injections.